Binance reports $2.85B in crypto stolen via exploit

Binance confirmed that its hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses. The company received an internal alert regarding large-volume transfers and immediately began investigating.

The attackers used a signing service to exploit Ethereum’s EIP-7702 authorization mechanism, which allows an account to delegate execution rights to a smart contract without exposing the private key. This enabled the attackers to grant an attacker-controlled smart contract partial execution rights over a Binance hot wallet.

Binance took swift action by suspending withdrawals, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts resulted in the freezing of a total of $2.85 billion in assets.

Despite these measures, the attackers were able to continue moving assets because the malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure. The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations.

Revoking these on-chain authorizations proved technically complex due to the use of Multi-Party Computation (MPC) in the hot wallet. This setup meant there was no single private key to immediately revoke the malicious authorizations, requiring a specialized procedure.

Suspension of withdrawals and shutdown of hot wallet services did not automatically invalidate existing on-chain authorizations. Binance had to execute additional transactions to fully revoke the malicious EIP-7702 authorizations.